Lesson 4: Introduction to Planning

When you decide to establish a Windows 2000 network environment, you must consider how to implement a DNS namespace and Active Directory directory services. First, examine the business structure and operation of your organization.

In many organizations, the IS department defines and implements the network structure down to the smallest detail. Other organizations, especially large enterprises, take a decentralized approach to managing business relationships and networks. These organizations might have multiple business units, each with different requirements for managing their network resources.

When planning the implementation of a namespace and Active Directory directory services for your organization, consider the following issues: physical office locations, future growth and reorganization, and access to network resources. This lesson introduces some of the general considerations in planning for your Active Directory directory services implementation.

If your network already has a presence on the Internet, you must decide whether to extend the external namespace for internal use or to create a new namespace.

You can extend an existing namespace to include it in Windows 2000 Server domains. You should consider using the same namespace for internal and external resources when you want to do the following:

• Have consistent tree names for internal and external resources
• Use the same logon and user names for internal and external resources
• Reserve no more than one DNS namespace

When you use the same namespace, you must create two separate DNS zones for your organization. One zone provides name resolution for internal resources, and the other provides name resolution for external resources, such as Web servers, File Transfer Protocol (FTP) servers, mail servers, and so on.

You also can have different namespaces for internal and external resources. In this configuration, all internal corporate servers use one namespace, while external resources, such as Internet and FTP servers, use a different namespace. This configuration requires you to reserve two namespaces with an Internet DNS registration authority. Consider using different namespaces for internal and external resources when you want to have the following:

• A clear distinction between internal and external resources
• Separate internal and external resource management
• Simple client browser and proxy client configuration

You maintain a domain structure and a site structure separately in Active Directory directory services. A single domain can include multiple sites, and a single site can include multiple domains, or parts of multiple domains.

As you plan sites, consider the availability of bandwidth for the replication traffic that occurs within a domain. For example, assume that you have offices in Phoenix, Arizona, and Flagstaff, Arizona, and assume that both offices are in the same site. In this case, the domain controllers in each office would be replicating frequently. However, by establishing each office as a separate site, you can specify a replication schedule to take advantage of hours when there is less demand on network resources, when more connections are available, or even when dial-up connections are less expensive.

Use the following guidelines as you plan how to combine subnets into sites:

• Combine only those subnets that share fast, inexpensive, and reliable network connections of at least 512 Kbps.
• Configure sites so that replication within the site occurs at times or intervals that do not interfere with network performance.

In a single domain, you can organize user accounts and resources by using a hierarchy of OUs to reflect the structure of your company. Just as your organization can have multiple levels of management, you can establish multiple levels of management within a domain based on OUs.

Consider creating an OU if you want to do the following:

• Reflect your company's structure and organization within a domain (see Figure 4.11). Without OUs, all user accounts are maintained and displayed in a single list, regardless of a user's department, location, or role.
• Delegate administrative control over network resources while maintaining the ability to manage them. You can grant administrative permissions to user accounts or groups at the OU level.
• Accommodate potential changes in your company's organizational structure. You can move user accounts between OUs easily, while moving user accounts between domains generally requires more time and effort.
• Group objects to allow administrators to locate similar network resources more easily to perform administrative tasks. For example, you could group all user accounts for temporary employees in an OU.
• Restrict visibility of network resources in Active Directory directory services. Users can view only the objects to which they have access.

Figure 4.11 Organizational units

Planning for implementing Active Directory directory services can be extremely complex. For example, when you plan the implementation of a namespace and Active Directory directory services for your organization, you must consider the following issues: physical office locations, future growth and reorganization, and access to network resources. If your network already has a presence on the Internet, you must decide whether to extend the external namespace for internal use or to create a new namespace.

When you plan your sites, you must consider the availability of bandwidth for the replication traffic within a domain. You might also want to determine how to take advantage of hours when there is less demand on network resources, when more connections are available, or even when dial-up connections are less expensive.

You also have to plan your OU structure. Your OU structure could reflect your company's structure and organization within a domain, allow you to delegate administrative control over network resources while maintaining the ability to manage them, or restrict visibility of network resources in Active Directory directory services.